[{"data":1,"prerenderedAt":189},["ShallowReactive",2],{"publication:en:P183":3},{"meta":4,"copy":17,"relatedArticles":149,"terms":181,"term":182,"resourceParent":183,"glossaryParent":186},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P183","\u002Fblog\u002Fgoogle-workspace-security-checklist","article","Google Workspace security checklist","Google Workspace security checklist: accounts, mail and sharing","Google Workspace security checklist for businesses","Review administrators, recovery, 2-Step Verification, Gmail, Drive and app access. Build an action register around the actual Workspace edition and evidence.",[13,14],"\u002Fservices\u002Fcorporate-email","\u002Fservices\u002Faccess-2fa-audit","2026-06-18","2026-10-30",{"intro":18,"sections":19,"checklistTitle":97,"checklist":98,"faq":106,"sources":116,"links":121,"cta":144},"A Google Workspace security checklist should connect administrator ownership, recovery, 2-Step Verification, Gmail routes, Drive sharing and app permissions to the edition and configuration the business actually uses. Review the relevant users, groups and organizational units, retain evidence and assign each gap an owner. A setting enabled for one group is not proof that the whole organization has the same protection.",[20,29,38,47,83,92],{"title":21,"paragraphs":22,"sources":25},"Map the organization before reviewing its controls",[23,24],"Record the business domains, Workspace edition, administrators, user groups, organizational units and connected systems in scope. Identify who controls the domain and billing, who can recover administrator access and which external providers retain a role. Business size alone does not determine every security need, especially where the information or contractual requirements are more demanding.","Google offers different checklist guidance for different organizational needs. Use the actual edition, available features and business workflow to define this review, rather than assume every console control or investigation tool exists for every customer. Mark unavailable evidence and unsupported features explicitly instead of treating an inaccessible screen as a clean result.",[26],{"label":27,"url":28},"Google Workspace: security checklists and business scope","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fsecurity\u002Fsecurity-checklists",{"title":30,"paragraphs":31,"sources":34},"Review administrators, verification and recovery as one boundary",[32,33],"Confirm the people who hold administrative privileges and the reason for each continuing role. Separate ordinary staff work from privileged administration where appropriate. Review the authorized recovery arrangements and backup administrative coverage so a lost device or departed person does not leave the business unable to manage its own organization.","Check the intended 2-Step Verification methods, enrollment and enforcement for the relevant scope, along with remaining exceptions. Test a safe representative path before changing enforcement broadly. Recovery methods and temporary access should have owners and protection; disabling verification across the organization is not a general solution to one person's lockout.",[35],{"label":36,"url":37},"Google Workspace: administrator security and recovery","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fusers\u002Fsecurity-best-practices-for-administrator-accounts",{"title":39,"paragraphs":40,"sources":43},"Trace Gmail routing and sending identities",[41,42],"Review material aliases, routing, forwarding, delegated access and external sending applications against the business need. A forgotten rule can direct mail somewhere the current team no longer expects. Confirm the owner before removing a legitimate operational route, and preserve the relevant evidence if an unexpected configuration may indicate an incident.","For each material source, verify a controlled message and the intended authentication identity. DKIM publication and active signing are separate checks; SPF and DMARC alignment also depend on the actual route. A passing staff-mail example does not establish that website or billing notifications authenticate correctly, and a domain-authentication result is not a Gmail account-security verdict.",[44],{"label":45,"url":46},"Google Workspace: set up and verify DKIM","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fsecurity\u002Fset-up-dkim",{"title":48,"paragraphs":49,"table":52},"Review Drive sharing and connected apps with business owners",[50,51],"Identify material external sharing, broad link access, group-based permissions and ownership of business-critical files. Select representative sensitive workflows and compare access with the intended recipients. A file still being visible to a supplier may be legitimate, excessive or obsolete; the business context determines the next action.","Review relevant OAuth applications, requested scopes and any delegated access through the authorized administrative tools. A familiar sign-in screen or app name is not sufficient evidence that every requested permission is needed. Restrict a risky integration through the supported controls with an owner and test plan, rather than deleting every grant without understanding which workflow depends on it.",{"caption":53,"headers":54,"rows":58},"Workspace evidence and next-action register",[55,56,57],"Boundary","Evidence to review","Business acceptance",[59,63,67,71,75,79],[60,61,62],"Admin and recovery","Current roles, authorized owners and recovery arrangements.","The business retains protected administrative continuity.",[64,65,66],"2-Step Verification","Configured scope, enrollment, enforcement and a controlled sign-in.","The intended accounts receive the required protection.",[68,69,70],"Gmail and domain sources","Routing\u002Fdelegation plus controlled received messages.","Mail follows the intended route with the expected identities.",[72,73,74],"Drive sharing","Relevant recipients, groups and link behavior.","Authorized collaborators work and excess access is addressed.",[76,77,78],"Connected apps","Owner, OAuth scope and justified access.","The integration works with the agreed permission boundary.",[80,81,82],"Evidence and changes","Available records, original values and after-change tests.","The conclusion states what was verified and what remains unknown.",{"title":84,"paragraphs":85,"sources":88},"Use actual evidence and a controlled change process",[86,87],"Check the administrative, sign-in, Gmail, Drive or application records available under the edition and reviewer's role. Retain timestamps, relevant scope and the observation window. A missing event can reflect retention, access or coverage limits. Do not turn the absence of a visible record into a claim that no unauthorized activity occurred.","For each proposed improvement, name an owner, affected group or organizational unit, original state, intended delta and acceptance test. Start with an appropriate controlled scope when broad enforcement could interrupt the organization. Confirm that the administrator recovery route remains usable and that business-critical collaboration, mail and integrations still work.",[89],{"label":90,"url":91},"Google Workspace: app access and OAuth scopes","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fapps\u002Fcontrol-which-apps-access-google-workspace-data",{"title":93,"paragraphs":94},"Produce a review result the business can maintain",[95,96],"Use statuses such as verified, change required, awaiting business approval, unavailable under the current edition and not tested. After approved changes, repeat the relevant checks and retain the result. Review access again when staff, suppliers, apps or data-sharing needs change. A one-time checklist does not replace ongoing ownership or a separate incident investigation.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with account-access, business-email and digital-infrastructure services. Our Israeli technical knowledge supports a scoped review that connects console settings to real business behavior. The work and available capabilities are agreed for the actual environment, without claiming Google partnership or universal compliance.","Google Workspace review acceptance",[99,100,101,102,103,104,105],"Edition, domains, groups and organizational units in scope","Administrator ownership and protected recovery arrangements","2SV enrollment, enforcement and exceptions tested appropriately","Gmail routing and material sending sources verified","Drive sharing and app\u002Fdelegation permissions reviewed with owners","Evidence limitations and controlled change decisions recorded","After-change business tests and follow-up owners assigned",[107,110,113],{"question":108,"answer":109},"Does a setting applied to one organizational unit protect everyone?","Not necessarily: review the setting's actual scope, relevant groups or units, inheritance and exceptions. Test representative accounts where appropriate. A successful result for one user supports that tested path, not every identity in the organization.",{"question":111,"answer":112},"Should I remove every third-party application?","Review the owner, business purpose and required scopes first. Some integrations are legitimate and critical, while others may be unnecessary or overly broad. Use supported controls and a tested change so reducing access does not silently break a required workflow.",{"question":114,"answer":115},"Is this checklist a compliance assessment?","It is a practical technical review framework. The evidence and scope depend on the actual environment. Legal, contractual or sector-specific requirements need their own assessment; do not treat a completed console checklist as proof of compliance in every country.",[117,118,119,120],{"label":27,"url":28},{"label":36,"url":37},{"label":90,"url":91},{"label":45,"url":46},[122,124,126,129,132,135,138,141],{"path":13,"label":123},"Discuss Workspace email configuration and review",{"path":14,"label":125},"Review account verification and recovery",{"path":127,"label":128},"\u002Fglossary\u002Fmfa","Understand factors and enforcement",{"path":130,"label":131},"\u002Fblog\u002Fdkim-selector-check","Check the actual DKIM signing identity",{"path":133,"label":134},"\u002Fblog\u002Femployee-offboarding-access","Review access when a staff member leaves",{"path":136,"label":137},"\u002Fblog\u002Fmicrosoft-365-security-checklist","Compare a Microsoft 365 review boundary",{"path":139,"label":140},"\u002Fblog\u002Fworkspace-mfa-setup","Plan enrollment, enforcement and supported recovery",{"path":142,"label":143},"\u002Fblog\u002Fbusiness-email-backup","Verify mailbox recovery coverage separately from account settings",{"title":145,"description":146,"button":147,"type":148},"Review Workspace around the way your team works","Describe the edition, services and current concern. We can agree the access, evidence and implementation scope before changes.","Discuss a Workspace security review","check",[150,159,166,173],{"id":151,"path":152,"title":153,"description":154,"category":155,"artwork":156,"order":157,"publishedOn":158},"P064","\u002Fblog\u002Fmicrosoft-365-account-compromise","Microsoft 365 account compromised: containment and recovery checks","Contain a suspected Microsoft 365 account compromise with authorized access, evidence, rule and app review, and verified recovery beyond a password reset.","email","access",33,"2026-06-02",{"id":160,"path":136,"title":161,"description":162,"category":155,"artwork":163,"order":164,"publishedOn":165},"P182","Microsoft 365 security checklist for small businesses","Review tenant ownership, admin recovery, authentication, mail, sharing and apps. Match checks to licenses and record evidence before changing business access.","plan-business",44,"2026-07-04",{"id":167,"path":142,"title":168,"description":169,"category":155,"artwork":170,"order":171,"publishedOn":172},"P189","Business email backup and recovery: check coverage before you need it","Review mailboxes, shared mail, recovery points and permissions. Distinguish sync, retention, export and backup, then verify a controlled business recovery.","backups",27,"2026-05-17",{"id":174,"path":175,"title":176,"description":177,"category":155,"artwork":178,"order":179,"publishedOn":180},"P181","\u002Fblog\u002Fdmarc-report-reading","How to read DMARC reports and choose the next sender check","Read DMARC report windows, source counts, identities and alignment. Use a triage worksheet while keeping reported handling separate from inbox placement.","audit",51,"2026-07-20",[],null,{"path":184,"label":185},"\u002Fresources","Website security resources and templates",{"path":187,"label":188},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058213]